31–40 of 114 posts
If you're looking for a tailscale alternative (ish), I built a plugin for HashiCorp Vault to manage Wireguard keys: https://github.com/candiddev/vault-plugin-secrets-wireguard It's a bit more involved than Tailscale with the benefit that it uses Vault's robust authentication options.
Good on tailscale for fostering the community and not playing this like most startups would!
Its really impressive how much Tailscale care about the UX of the whole product all the way down to the level of not over complicating their menus. The whole Tailscale experience for an enduser (ie not Tailscale admin) is so much nicer than compared with something like OpenVPN in a place without MDM.
An extra field in an "Advanced Settings" menu should not need to be hidden behind some "Press About 5 times" secret gauntlet. Users are not so stupid that they will fill out an "Advanced" form field they don't understand, and even if they do, you can always make a connection attempt to see if the input was valid.
This is a a beautiful thread. All the concerns that come into play with a commercial business, a very human representative of that business, and someone outside expressing a need. A need that some would see is contradictory to the pure business goals. Doing business out in the open like Tailscale is doing is so refreshing. Having seen Brad Fitz communicate in other places, it is obvious he isn't doing the right thing…
Earlier quoted context omitted.
Tailscale employee here: In general the OSS operating systems get OSS clients, whereas the closed-source ones don’t necessarily get the full OSS treatment.
Appreciate the reply, Tailscaler. That makes sense and seems like a legitimate line to draw. Being a little bit of a pain, I would point out that the Google Play store and Google's components for Android are not open source. If you're willing to make Tailscale available via Google Play, and open source the client, maybe iOS can as well? And while we're at it, macOS apps can be installed out of band of an app store, s…
As far as I can tell, the only Google Play Services API the app distributed on the Play Store uses is Google account authentication via the Play Services Google account picker.
From a security perspective, I would design this feature differently. If the capability to change the control server exists, then, rather than hiding it, I would want to see a prominent UI element displaying the control server name, url and "more details" to the user to see before they connect/login.
This is important to prevent any social engineering based security hacks.
Its really impressive how much Tailscale care about the UX of the whole product all the way down to the level of not over complicating their menus. The whole Tailscale experience for an enduser (ie not Tailscale admin) is so much nicer than compared with something like OpenVPN in a place without MDM.
> down to the level of not over complicating their menus to be fair, their mobile UX has plenty of warts and behaviors that don't match platform expectations and are confusing (like what happens when you tap on any of the listed machines that you have access to). This one seems to at least have been partially motivated by making sure that accessing tailscale without paying is not too visible. I'm saying this as a hug…
Not sure what this means, Tailscale is free for the vast majority of non-corporate users, and I would imagine that anyone who's using it so intensely that they need the "personal pro" plan is probably someone techie enough to dig around and find out about headscale.
Also headscale isn't entirely free if you're paying for a VPS or other server to host it on.
If you're looking for a tailscale alternative (ish), I built a plugin for HashiCorp Vault to manage Wireguard keys: https://github.com/candiddev/vault-plugin-secrets-wireguard It's a bit more involved than Tailscale with the benefit that it uses Vault's robust authentication options.
Interesting. I would never use a hosted VPN service because I want to be the only one who controls access. For this reason I don't use something like ZeroTier either (even though that can technically be self-hosted, it's not easy). But Mesh VPN is a great option. I wonder if Headscale can also use internal credentials? As far as I remember with tailscale you had to log in with Google or Microsoft which is another tot…
>I wonder if Headscale can also use internal credentials? As far as I remember with tailscale you had to log in with Google or Microsoft which is another total deal-breaker. But I haven't looked at it in ages as the hosted variety was a non starter anyway. from the project page: https://github.com/juanfont/headscale >Node registration > • Single-Sign-On (via Open ID Connect) > • Pre authenticated key